DigitalOcean says customer billing data accessed in data breach | Hacker News Reader

DigitalOcean says customer billing data accessed in data breach

techcrunch.com

58 pointstoomuchtodo13 comments

Service-operator-on-receiving-end-of-years-of-dodgy-DO-Network-packets here:

Maybe there's some cosmic justice if the DO customers who've been endlessly crapping up our logs get spammed themselves.

I'm not completely sure what exactly you are trying to say, but it seems to me that I somehow deserve some of my personal information being stolen, because someone that also uses DigitalOcean sends you "dodgy packets". What?

I made no comment regarding DO allowing your info to be exfil'd. I was opining that the spammers that are comfortable on DO networks deserve any spamming that might come their way.

article says we got an email notification? I didn't :(

most recent message is to top up my account

According to article, only 1% of users are affected and only those have been notified. I have received the e-mail.

oh, I shouldve scrolled further.

in my defense the page was doing that jumpy /jerky scrolly jank that frustrates me so I bailed early.

You're apparently lucky in two cases. No email. And with a top-up notification, also no CC on file. :)

How they know only x% of users effected and which one? Not sure if they concluded that after reviewing the leaked data?

Interesting question where TC got that information. The e-mail only states "This exposure impacted a small percentage of our customers." but no explicit percentage.

EDIT: Rereading the article helped: they received a statement from DO.

Thanks. But, I was trying to find out - how ‘DO’ - or any other breached company for that matter - come to know about the effected users. Sorry, I missed mentioning that

I did these are contents of the email.

    Hello,
    
    
    On April 26, 2021, we confirmed an unauthorized exposure of details associated with the billing profile on your DigitalOcean account. The exposure has been fixed, and your complete payment card account number was not exposed. We will monitor your DigitalOcean account for any unusual activity. No action is required by you at this time.
    
    
    What happened:
    
        An unauthorized user gained access to some of your billing account details through a flaw that has been fixed. This exposure impacted a small percentage of our customers. 
        The unauthorized access occurred between April 9, 2021 and April 22, 2021.
        The following billing profile information was accessed:
            Billing Name
            Billing Address
            Payment Card Expiration
            Last 4 Digits of Payment Card
            Payment Card Bank Name
        We do not store your full payment card account number, and it was not exposed.
    
    What we have done:
    
        We have fixed the flaw that enabled this exposure, and unauthorized parties can no longer access this information.
        We have notified relevant data protection authorities.
        To be extra careful, we have implemented additional security monitoring on your account.
        We are expanding our security measures to reduce the likelihood of this kind of flaw occuring in the future. 
    
    How this impacts your account:
    
        Your DigitalOcean account was not accessed. Our account recovery procedures require more information than what was exposed. Your account is not at risk.
        Your account password and tokens were not involved in this exposure.
        Requests to change your account details may take longer to process and may require additional verification.
        No action is required by you at this time.
    
    We believe in holding ourselves accountable to our customers and are committed to protecting your account. We welcome the opportunity to talk through any questions or concerns you may have — just reply to this email.
    
    
    Thanks,
    
    Trust @ DigitalOcean

Definitely did not receive an email after Privacy blocked the transaction from happening on my DO card.

Unrelated: Privacy Badger says this site has 40 (!) trackers. Why so many?

Reply on news.ycombinator.com